Is CVE-2026-61450 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61450 being exploited in the wild.

How severe is CVE-2026-61450?

Medium severity, with a CVSS score of 6.5, published 10 July 2026.

Which products and versions are affected?

Grav before 2.0.2; getgrav/grav (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.2.

Is there a fix for CVE-2026-61450?

Yes. getgrav/grav (Packagist): upgrade to 2.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61450 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-61450?

Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61450: Grav Twig sandbox bypass in grav.offsetGet method

CVE-2026-61450 · Severity: medium · CVSS 6.5 · Published 2026-07-10

Grav, a popular open-source content management system, is affected by a security bypass that allows users with page-editing permissions to steal sensitive system secrets. By using specific commands within a page's content, an attacker can bypass security restrictions to view the site's full configuration, including SMTP email passwords, API keys, and database credentials. This could lead to a broader compromise of the organization's connected services and infrastructure.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-61450 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61450 being exploited in the wild.
How severe is CVE-2026-61450?: Medium severity, with a CVSS score of 6.5, published 10 July 2026.
Which products and versions are affected?: Grav before 2.0.2; getgrav/grav (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.2.
Is there a fix for CVE-2026-61450?: Yes. getgrav/grav (Packagist): upgrade to 2.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61450 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-61450?: Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

getgrav/grav (Packagist): upgrade to 2.0.2 or later
```
composer require getgrav/grav:^2.0.2
```

Technical details

A Twig sandbox bypass exists in Grav versions prior to 2.0.2 due to an incomplete fix for a previous vulnerability. While the 'config' variable is replaced with a redacted facade, the raw configuration container remains accessible via the allow-listed 'grav.offsetGet('config')' method. Attackers can then use allow-listed object-dumping filters such as 'json_encode', 'print_r', or 'yaml_encode' to serialize the real Config object. Because these filters operate at the PHP level without triggering the sandbox's method gate, they expose the entire configuration tree. This allows any user with 'admin.pages' permissions or filesystem write access to 'user/pages' to exfiltrate sensitive plugin secrets. The issue is addressed in version 2.0.2 by removing 'offsetget' from the allowed methods for the Grav container and hardening object-dumping filters.

Affected products

getgrav Grav before 2.0.2

Identifiers

CVE-2026-61450
GHSA-mc5q-6hpj-rp7j

Timeline

2026-06-25: advisory: Original GitHub security advisory published
2026-07-10: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.